exec-python

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Security

Grade A, and why

exec-python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

skills/exec-python/SKILL.md · 25 lines

What it actually says

Python standards:
- PEP 8 naming: snake_case functions/vars, PascalCase classes, UPPER_SNAKE constants.
- Type hints on all public functions (params + return); use modern syntax the project's Python
  version supports (e.g. `list[str]`, `X | None`).
- Errors: raise specific exceptions, never bare `except:`; catch the narrowest type that you can
  actually handle; chain with `raise ... from err` to preserve context.
- No mutable default arguments (def f(x=[]) bug) — use None + assignment.
- Prefer comprehensions/generators over manual loops when clearer; pathlib over os.path;
  f-strings over % or .format; dataclasses (or the project's model library, e.g. pydantic) over
  bare dicts for structured data.
- Context managers (with) for files, locks, connections — never rely on GC for cleanup.
- Respect the project's tooling: existing linter/formatter config (ruff/black), import order,
  and dependency manager (uv/poetry/pip) — add deps only via its manifest.
- Tests: pytest style if the project uses it — plain asserts, fixtures over setUp, parametrize
  for case tables.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

Related

Other skills, from other repositories